A stack-based buffer overflow exists in the formQuickIndex function located at /goform/QuickIndex of Tenda CH22 firmware 1.0.0.1. By crafting the mit_linktype parameter, an attacker can overflow a stack buffer, potentially leading to arbitrary code execution or malicious behavior. Because the flaw is in the web interface, the attack can be performed remotely over the network that the router exposes its management interface to.

Devices utilizing the Tenda CH22 router with firmware version 1.0.0.1 are affected. The vulnerability is confined to the Parameter Handler component of that firmware revision; no other Tenda products or firmware versions are listed as vulnerable.

The CVSS score of 8.7 indicates a high severity vulnerability, while the EPSS score of less than 1% suggests a relatively low probability of exploitation across the broader ecosystem. The flaw is publicly disclosed and exploitable remotely, but the CVE record does not specify whether authentication is required to trigger the overflow. The vulnerability is not yet included in the CISA KEV catalog, yet its potential for remote code execution warrants proactive attention.